stable-diffusion-webui CVE-2026-111985

Exploitation requires a victim to load an attacker-crafted .safetensors model file whose metadata header-length field has been manipulated; the vulnerable code path is the Metadata Extraction component's read_metadata_from_safetensors function in modules/sd_models.py. The key limiting factor is mandatory user interaction (CVSS UI:P) - the attacker cannot trigger this against an idle service but must induce the user to download and load the malicious model (e.g., from a model-sharing repository). No authentication to the web UI by the attacker is needed, and affected versions are AUTOMATIC1111 stable-diffusion-webui up to and including 1.10.1 with no vendor patch currently available. Impact is limited to denial of service (resource exhaustion) of the web UI process; there is no data disclosure or code execution.

All signals converge on LOW real-world risk despite the public exploit. The vendor-supplied CVSS 4.0 base score is 2.1 (Low), reflecting that the only technical impact is a low-severity availability hit (VA:L) with no confidentiality or integrity impact (VC:N/VI:N) and no scope change - consistent with CWE-400 uncontrolled resource consumption rather than code execution. The vector requires passive user interaction (UI:P), meaning a victim must load an attacker-supplied safetensors file, which materially limits automatability (this is NOT a fire-and-forget remote exploit). No EPSS score was provided, so exploitation probability cannot be quantified from the input. The CVE is NOT in CISA KEV, and no active exploitation is claimed - only publicly available exploit code exists (SSVC exploitation status 'poc', matching E:P in the vector). Conflicting/weak signals to note: the description says 'launched remotely' but the CVSS vector's UI:P shows exploitation hinges on a user loading a malicious model file, so 'remote' here means a hosted/shared file rather than unauthenticated network-service exploitation. The vendor was notified via issue report but has not responded, so no patch exists - the primary risk driver is unpatched status, not impact severity. Bottom line: a low-impact, user-interaction-gated DoS in a hobbyist/research tool; publicly available exploit code raises nuisance potential but this is a high-visibility-but-low-real-risk issue, not a priority for most environments.

An attacker publishes a malicious Stable Diffusion model (.safetensors) on a model-sharing site with a tampered header-length field. When a victim downloads and loads the model, read_metadata_from_safetensors in modules/sd_models.py allocates resources based on the attacker-controlled length value, exhausting memory and crashing or hanging the web UI process. A public proof-of-concept (poc.zip) exists, but exploitation requires the victim to load the crafted file (CVSS UI:P), so it is not fully automatable.